Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-10 22:00 CEST]:
> Does the above mean that the Shibboleth IdP currently can get the
> "uid" attribute from the user in LDAP

You have your config (attribute-resolver.xml). You can see where it
comes from.

> Also does that help for figuring out how to get the NameID to work?

There's no such thing as "a/the NameID": There are different NameID
Formats (and "unspecified" is not a format anyone can sanely require
you to send).
So the first question now is what specific NameID Format the other
system (the other IDP's SP, IIRC) expects to recieve because you can't
just send it "a NameID".
The SAML 2.0 specification includes a few definitions (see section
8.3 in this document,
https://groups.oasis-open.org/higherlogic/ws/public/download/56777/sstc-saml-core-errata-2.0-wd-07-diff.pdf)
amd you have already seen "transient" NameIDs in your IDP.
(If none of the standard-defined values match your use-case you can
also send other formats. I'll not cover this here.)

Once you know what NameID Format the SP needs you can decice what
internal attribute in your Shibboleth IDP you want to create this
NameID value from. Which in your case probably means amendng your
attribute resolver conf to look up the required data from LDAP or
elsehwere. Then you can proceed to configure a NameID in the
approriate config files (conf/saml-nameid.*)

-peter